Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
3 Added another thing i tried
source | link

I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -

alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, established; pcre: !"/\x0D\x0A\x0D\x0A$/H"; threshold: type threshold, track by_dst, count 10, seconds 5; sid 3000009; rev:1;)

(I may have messed up the syntax a bit but that's because trying to format it here, i'm positive that the syntax is okay on my end)

I also tried messing with the RE a bit, tried "/\x0D\x0A$/H" and that didn't work either

The Slow-Loris that i tried to write myself and the Slow Loris which i downloaded from somewhere both send packets with "incomplete" HTTP headers, so they don't end with \r\n\r\n like a finished header. But i can't manage to catch either one.

Looked at the packets on Wireshark and they end with 0D 0A

Looked at downloaded.rules and the rule isn't there. Did tail for snort.conf and there are no errors there. Did service nsm status to see maybe the service itself didn't go up correctly, but it's all OK. EDIT - There was a : missing, i fixed it and now it appears on downloaded.rules. still doesn't get caught though

Not really sure what i'm doing wrong, would appreciate some help.

I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -

alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, established; pcre: !"/\x0D\x0A\x0D\x0A$/H"; threshold: type threshold, track by_dst, count 10, seconds 5; sid 3000009; rev:1;)

(I may have messed up the syntax a bit but that's because trying to format it here, i'm positive that the syntax is okay on my end)

I also tried messing with the RE a bit, tried "/\x0D\x0A$/H" and that didn't work either

The Slow-Loris that i tried to write myself and the Slow Loris which i downloaded from somewhere both send packets with "incomplete" HTTP headers, so they don't end with \r\n\r\n like a finished header. But i can't manage to catch either one.

Looked at the packets on Wireshark and they end with 0D 0A

Looked at downloaded.rules and the rule isn't there. Did tail for snort.conf and there are no errors there. Did service nsm status to see maybe the service itself didn't go up correctly, but it's all OK.

Not really sure what i'm doing wrong, would appreciate some help.

I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -

alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, established; pcre: !"/\x0D\x0A\x0D\x0A$/H"; threshold: type threshold, track by_dst, count 10, seconds 5; sid 3000009; rev:1;)

(I may have messed up the syntax a bit but that's because trying to format it here, i'm positive that the syntax is okay on my end)

I also tried messing with the RE a bit, tried "/\x0D\x0A$/H" and that didn't work either

The Slow-Loris that i tried to write myself and the Slow Loris which i downloaded from somewhere both send packets with "incomplete" HTTP headers, so they don't end with \r\n\r\n like a finished header. But i can't manage to catch either one.

Looked at the packets on Wireshark and they end with 0D 0A

Looked at downloaded.rules and the rule isn't there. Did tail for snort.conf and there are no errors there. Did service nsm status to see maybe the service itself didn't go up correctly, but it's all OK. EDIT - There was a : missing, i fixed it and now it appears on downloaded.rules. still doesn't get caught though

Not really sure what i'm doing wrong, would appreciate some help.

2 Edited to say that i checked things that usually give error messages
source | link

I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -

alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, established; pcre: !"/\x0D\x0A\x0D\x0A$/H"; threshold: type threshold, track by_dst, count 10, seconds 5; sid 3000009; rev:1;)

(I may have messed up the syntax a bit but that's because trying to format it here, i'm positive that the syntax is okay on my end)

I also tried messing with the RE a bit, tried "/\x0D\x0A$/H" and that didn't work either

The Slow-Loris that i tried to write myself and the Slow Loris which i downloaded from somewhere both send packets with "incomplete" HTTP headers, so they don't end with \r\n\r\n like a finished header. But i can't manage to catch either one.

Looked at the packets on Wireshark and they end with 0D 0A

Looked at downloaded.rules and the rule isn't there. Did tail for snort.conf and there are no errors there. Did service nsm status to see maybe the service itself didn't go up correctly, but it's all OK.

Not really sure what i'm doing wrong, would appreciate some help.

I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -

alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, established; pcre: !"/\x0D\x0A\x0D\x0A$/H"; threshold: type threshold, track by_dst, count 10, seconds 5; sid 3000009; rev:1;)

(I may have messed up the syntax a bit but that's because trying to format it here, i'm positive that the syntax is okay on my end)

I also tried messing with the RE a bit, tried "/\x0D\x0A$/H" and that didn't work either

The Slow-Loris that i tried to write myself and the Slow Loris which i downloaded from somewhere both send packets with "incomplete" HTTP headers, so they don't end with \r\n\r\n like a finished header. But i can't manage to catch either one.

Looked at the packets on Wireshark and they end with 0D 0A

Not really sure what i'm doing wrong, would appreciate some help

I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -

alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, established; pcre: !"/\x0D\x0A\x0D\x0A$/H"; threshold: type threshold, track by_dst, count 10, seconds 5; sid 3000009; rev:1;)

(I may have messed up the syntax a bit but that's because trying to format it here, i'm positive that the syntax is okay on my end)

I also tried messing with the RE a bit, tried "/\x0D\x0A$/H" and that didn't work either

The Slow-Loris that i tried to write myself and the Slow Loris which i downloaded from somewhere both send packets with "incomplete" HTTP headers, so they don't end with \r\n\r\n like a finished header. But i can't manage to catch either one.

Looked at the packets on Wireshark and they end with 0D 0A

Looked at downloaded.rules and the rule isn't there. Did tail for snort.conf and there are no errors there. Did service nsm status to see maybe the service itself didn't go up correctly, but it's all OK.

Not really sure what i'm doing wrong, would appreciate some help.

1
source | link

IDS Snort rule to catch Slow-Loris

I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -

alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, established; pcre: !"/\x0D\x0A\x0D\x0A$/H"; threshold: type threshold, track by_dst, count 10, seconds 5; sid 3000009; rev:1;)

(I may have messed up the syntax a bit but that's because trying to format it here, i'm positive that the syntax is okay on my end)

I also tried messing with the RE a bit, tried "/\x0D\x0A$/H" and that didn't work either

The Slow-Loris that i tried to write myself and the Slow Loris which i downloaded from somewhere both send packets with "incomplete" HTTP headers, so they don't end with \r\n\r\n like a finished header. But i can't manage to catch either one.

Looked at the packets on Wireshark and they end with 0D 0A

Not really sure what i'm doing wrong, would appreciate some help